10.0crit
CVE-2000-0788
The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which cou…
Published 26 y ago · modified 4 mo ago · JSON
CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.4%
percentile 95%
Public exploits
0
none known
Summary
The Mail Merge tool in Microsoft Word does not prompt the user before executing Visual Basic (VBA) scripts in an Access database, which could allow an attacker to execute arbitrary commands.
Exploit prediction (EPSS)
8.42% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/5322 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/1566 · vdb-entry, x_refsource_BID, x_transferred
- docs.microsoft.com /en-us/security-updates/securitybulletins/2000/ms00-071 · vendor-advisory, x_refsource_MS, x_transferred
- securityfocus.com /templates/archive.pike?list=1&msg=398EB9CA.27E03A9C%40nat.bg · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2000-0788
- NVD: CVE-2000-0788
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.